Oleg noticed that I'm doing a strange games with mm::mmap_sem
member -- I take it and keep busy whie validating data which
comes from user space but then I release it and copy auxv
data itself.
This means we've a small window where previously found VMAs might
be no longer valid thus move @auxv validation and copying at the
beginning of prctl_set_mm_map before we take the lock.
Signed-off-by: Cyrill Gorcunov <gorcu...@openvz.org>
CC: Oleg Nesterov <o...@redhat.com>
Cc: Kees Cook <keesc...@chromium.org>
Cc: Tejun Heo <t...@kernel.org>
Cc: Andrew Morton <a...@linux-foundation.org>
Cc: Andrew Vagin <ava...@openvz.org>
Cc: Eric W. Biederman <ebied...@xmission.com>
Cc: H. Peter Anvin <h...@zytor.com>
Cc: Serge Hallyn <serge.hal...@canonical.com>
Cc: Pavel Emelyanov <xe...@parallels.com>
Cc: Vasiliy Kulikov <seg...@openwall.com>
Cc: KAMEZAWA Hiroyuki <kamezawa.hir...@jp.fujitsu.com>
Cc: Michael Kerrisk <mtk.manpa...@gmail.com>
Cc: Julien Tinnes <j...@google.com>
---
kernel/sys.c | 20 +++++++++++++-------
1 file changed, 13 insertions(+), 7 deletions(-)
Index: linux-2.6.git/kernel/sys.c
===================================================================
--- linux-2.6.git.orig/kernel/sys.c
+++ linux-2.6.git/kernel/sys.c
@@ -1838,22 +1838,28 @@ static int prctl_set_mm_map(int opt, con
if (copy_from_user(&prctl_map, addr, sizeof(prctl_map)))
return -EFAULT;
- down_read(&mm->mmap_sem);
-
- if (validate_prctl_map_locked(&prctl_map))
- goto out;
-
+ /*
+ * Validate and copy auxv early to be able to keep
+ * @mmap_sem taken until this function ends.
+ */
if (prctl_map.auxv_size) {
- up_read(&mm->mmap_sem);
+ if (!prctl_map.auxv ||
+ prctl_map.auxv_size > sizeof(mm->saved_auxv))
+ return -EINVAL;
+
memset(user_auxv, 0, sizeof(user_auxv));
error = copy_from_user(user_auxv,
(const void __user *)prctl_map.auxv,
prctl_map.auxv_size);
- down_read(&mm->mmap_sem);
if (error)
goto out;
}
+ down_read(&mm->mmap_sem);
+
+ if (validate_prctl_map_locked(&prctl_map))
+ goto out;
+
if (prctl_map.exe_fd != (u32)-1) {
error = prctl_set_mm_exe_file_locked(mm, prctl_map.exe_fd);
if (error)
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
